narrow_widen_acl: enforce narrowacl in narrow_widen (SEC)
Reviewer note: this was sent by the author as a simple bugfix, but can be
considered a security patch, since it allows users to access things outside
of the ACL, hence the (SEC) prefix.
However, this affects the `narrow` extention which is still marked as
experimental and has relatively few users aside from large companies with
their own security layers on top from what we can gather.
We feel (Alphare: or at least, I feel) like pinging the packaging list is
enough in this case.
#require symlink
$ echo "[extensions]" >> $HGRCPATH
$ echo "mq=" >> $HGRCPATH
$ hg init
$ hg qinit
$ hg qnew base.patch
$ echo aaa > a
$ echo bbb > b
$ echo ccc > c
$ hg add a b c
$ hg qrefresh
$ readlink.py a
a -> a not a symlink
test replacing a file with a symlink
$ hg qnew symlink.patch
$ rm a
$ ln -s b a
$ hg qrefresh --git
$ readlink.py a
a -> b
$ hg qpop
popping symlink.patch
now at: base.patch
$ hg qpush
applying symlink.patch
now at: symlink.patch
$ readlink.py a
a -> b
test updating a symlink
$ rm a
$ ln -s c a
$ hg qnew --git -f updatelink
$ readlink.py a
a -> c
$ hg qpop
popping updatelink
now at: symlink.patch
$ hg qpush --debug
applying updatelink
patching file a
committing files:
a
committing manifest
committing changelog
updating the branch cache
now at: updatelink
$ readlink.py a
a -> c
$ hg st
test replacing a symlink with a file
$ ln -s c s
$ hg add s
$ hg qnew --git -f addlink
$ rm s
$ echo sss > s
$ hg qnew --git -f replacelinkwithfile
$ hg qpop
popping replacelinkwithfile
now at: addlink
$ hg qpush
applying replacelinkwithfile
now at: replacelinkwithfile
$ cat s
sss
$ hg st
test symlink removal
$ hg qnew removesl.patch
$ hg rm a
$ hg qrefresh --git
$ hg qpop
popping removesl.patch
now at: replacelinkwithfile
$ hg qpush
applying removesl.patch
now at: removesl.patch
$ hg st -c
C b
C c
C s
replace broken symlink with another broken symlink
$ ln -s linka linka
$ hg add linka
$ hg qnew link
$ hg mv linka linkb
$ rm linkb
$ ln -s linkb linkb
$ hg qnew movelink
$ hg qpop
popping movelink
now at: link
$ hg qpush
applying movelink
now at: movelink
$ readlink.py linkb
linkb -> linkb